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ABSTRACT 


Steganography is data hiding technique in internet. Here we send CAPTCHA 
codes within a cover image using image steganography. CAPTCHA are the 
crazy codes. They are used in human response test. The word is actually 
acronym for: “Completely Automated Public Turning test to tell Computers 
and Humans Apart”’. It is a type of challenge-response test used in computing 
to determine whether or not the user is human. Websites implement 
CAPTCHA codes into their registration process due to spam. This is the 
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1, INTRODUCTION 
1.1. Background 

Here CAPTCHA codes have been formed by at least one small letter, one capital letter, one number 
and one special character and it 1s minimum of 8 characters and maximum of 16 characters. CAPTCHA are 
used to check that the person registering or trying to comment is a real live human being as opposed to a 
computer program attempting to spam the site. 


1.2. The Problem 

If CAPTCHA codes are embedded directly using LSB [1] embedding technique then it is easy for 
the attackers to extract the CAPTCHA. So, a new technique has been implemented to change the actual 
CAPTCHA into an encrypted version and then that encrypted version has been embedded into cover 
image [2] resulting in a stego image [3]. 


1.3. The Proposed Solution 

We embed CAPTCHA into a 24 bit color image [4] as our cover image. We use LSB of Red, Green 
and Blue pixels [5] of 24 bit cover image in image steganography [6]. Embedding technique is based on an 
innovative algorithm that counts the frequency of 0’s and 1’s. We give priority to the lesser number of 
occurrences of 0’s or 1|’s present. At first, we store the flag’s value. If lesser number of 0’s 1s present then 
flag’s value will be 0, otherwise 1. Then we embed how many lesser number of 0’s or 1’s is present. 
We decide using this value total number of pixels needed to store the bit positions of 0’s or 1’s. Thus an 
ASCII [7] value is not directly embedded into the LSB of cover image, rather flag’s value, number of 
occurrence of lesser 0’s or 1’s, positions where lesser number of 0’s or 1’s are taken place would be 
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embedded which makes attacker impossible to retrieve the actual data [8] which is the ASCII value of the 
embedded character. A layer of encryption [9] has been taken place here. At the receiver’s end at first we 
extract flag’s value. Based on the flag’s [10] value we get the lesser occurrences of 0’s or 1’s. In this 
technique [11] then how many 0’s or 1’s are present would be extracted. After this the positions where lesser 
number of 0’s or 1’s are present that information would be extracted. This is the process to extract the whole 
information [12] about the embedded ASCH. Thus we gather whole information to retrieve the original 
ASCII that was sent via CAPTCHA through communication channel in internet 


2. THE PROPOSED METHOD 

2.1. Generation of CAPTCHA 

a) Generate a random number [13] between 8 and 16. Let it be n. (We consider that our CAPTCHA would 
be minimum of 8 characters and maximum of 16 characters) 

b) Initialize a string str as str=”” 

c) Perform following task for n times 

d) Generate random numbers between 97 and 122 (ASCII of a to z) and place it into the variable char. 

e) Concatenate, str=str+char 

f) | Generate random number between 48 and 57 (ASCII of O to 9) and place it into the variable char 

g) Concatenate, str=str+char 

h) Generate random number between 65 and 90 (ASCII of A to Z) and place it into the variable char 

1) Concatenate, str=str+char 

j) | Generate random number between 33 and 47 or 58 and 64 or 91 and 96 or 123 and 126 (ASCII of 
Special Characters) and place it into variable char. 

k) Concatenate, str=str+char 

1) Randomly we choose any step from 3 to 7 to generate any kind of char and keep concatenating. 

m) Repeat the step 8 until n number of characters has been generated. 

n) Terminate the CAPTCHA codes with the ASCII value dot (.) as the end of CAPTCHA code. 

o) Jumble up characters of CAPTCHA for a random number of times for repositioning of characters and 
thus the final CAPTCHA code 1s ready. 


2.2. Embedding [14] Technique 

a) As said, we generate a CAPTCHA of minimum 8 characters. 

b) CAPTCHA ensures to be generated by combining at least one capital letter, one small letter, one 
number and one special character. 

c) Check the length of the CAPTCHA. 

d) Take character one by one and do the following 

e) Take the ASCII value of the character 

f) Convert the ASCII value into equivalent binary value. 

g) Check number of 0’s and 1’s 1n this binary value. 

h) Ifthe number of Os is less than number of 1’s then flag’s value would be 0 otherwise flag’s value would 
be 1. 

1) Let the flag value be 0 and then we count how many 0’s are available 

j) Modify the LSB of red pixel of RGB cover image to store the flag value. 

k) Embed the number of 0’s into LSB of Green and Blue components of pixel 

1) | Embed the position of the occurrence of 0’s at the LSB of next RGB pixels as per requirements. 

m) Repeat the following steps until all the characters get embedded into cover image. 


2.3. Extraction [15] Technique 

a) Read first red, green and blue pixel of stego image. 

b) Extract flag bit based on the LSB of red pixel 

c) Extract LSB of green and blue pixel to calculate how many 1’s or 0’s are present afterward. 

d) Read next pixels’ LSBs to find the positions of 0’s or 1’s 

e) Based on this value, ASCII can be obtained. Thus relevant character, digit or special character can be 
found out. 

f) Repeat the step | to 4 for rest of the pixels until the ASCH value 46 of dot (.) is found which indicates 
the end of CAPTCHA code. Thus CAPTCHA codes are extracted via a secure steganography. 
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3. RESEARCH METHOD 

To construct CAPTCHA codes we consider the ASCII value is of 7 bits in binary representation.’ 
ASCII range for printable characters is from 0 to 127 and 127 needs a maximum of 7 bits to represent it 
in binary. Let us assume the generated CAPTCHA is B9 @m#~2q. It has a length of 8 characters except dot. 
Dot must be here the terminating character [16]. 

First we deal with B. Its ASCII value is 66. Binary [17] equivalent of 66 is 1000010. In 1000010, 
there are five 0’s and two 1‘s. As the number of 1’s is less, so we take the flag as 1. 1’s are present in 2" & 
7 bit position. Now we embed flag 1, then the number of 1’s 1.e., two, then bit [18] positions of 1’s, 
which are 2’ & 7" positions respectively. We embed this value by LSB modification of RGB colour cover 
image. Thus the ASCII value 66 1s encrypted as 6, 2, and 7. 6 come from 110, where | is the flag value and 
10 is the number of 1’s (1.e., two). 2 & 7 come from the position of 1’s. Next, 9 is the number that is used to 
construct the CAPTCHA. 

Its ASCII value is 57. Binary equivalent of 57 is 0111001. In 0111001, there are three 0’s and four 
1’s. So, the flag is 0. 0’s are present in second, third and seventh bit position. Now we have to embed flag 0, 
then number of 0’s 1.e., three, then bit positions of 0’s 1.e. second, third and seventh values by LSB 
modification of RGB cover image. Thus the ASCII value 57 1s encrypted [19] as 3, 2, 3, 7, where 3 means 
011 denoting 0 as flag, 3 as number of 0’s. 0’s are present in 2", 3“ & 7" position, resulting in 2, 3 & 7. 

Next character is @. Its ASCII value is 64. Binary equivalent of 64 is LOOOO00. In 1000000, there 
are six 0’s and one 1. As the number of 1’s is less, so we take the flag as 1. 1 is present in 7" bit position. 
Now we embed flag 1, then the number of 1’s 1.e., one, then bit positions of 1’s, which is 7". We embed this 
value by LSB modification of RGB coloured cover image. Thus the ASCII value 64 is encrypted as 5, 7. 5 
come from 101, where | is the flag value and 01 1s the number of 1’s. 7 come from the positions of 1. 

Next character is m. Its ASCII value is 109. Binary equivalent of 109 is 1101101. In 1101101, there 
are two 0’s and five 1’s. As the number of 0’s is less, so we take the flag as 0. 0’s are present in 2"? & 5™ bit 
position. Now we embed flag 0, then the number of 0’s 1.e., two, then bit positions of 0’s, which are 2 eS. 
We embed this value by LSB modification of RGB coloured cover image. Thus the ASCII value 109 is 
encrypted as 2, 2 and 5. 2 come from 010, where 0 is the flag value and 10 is the number of 0’s. 2 & 5 come 
from the positions of 0’s. 

Next character is #. Its ASCII value is 35. Binary equivalent of 35 is 0100011. In 0100011, there are 
four 0’s and three 1‘s. As the number of 1’s is less, so we take the flag as 1. 1’s are present in 1“, 2" & 6" bit 
position. Now we embed flag 1, then the number of 1’s i.e., three, then bit positions of 1’s, which are 1“, 2" 
& 6" We embed this value by LSB modification of RGB colour cover image. Thus the ASCII value 35 is 
encrypted as 7, 1, 2 and 6. 7 come from 111, where | is the flag value and 11 is the number of 1’s. 1, 2 & 6 
come from the positions of 1’s. 

Next character is ~. Its ASCII value is 126. Binary equivalent of 126 is 1111110. In 1111110, 
there are one O and six I‘s. As the number of 0’s is less, so we take the flag as 0. 0 is present in 1“ bit 
position. Now we embed flag 0, then the number of 0’s i.e., one, then bit positions of 0’s, which is at 1“ 
position. We embed this value by LSB modification of RGB colour cover image. Thus the ASCII value 126 
is encrypted as 1, 1. 1 comes from 001, where 0 is the flag value and 01 is the number of 0’s. 1 comes from 
the positions of 0’s. 

Next digit is 2. Its ASCII value is 50. Binary equivalent of 50 is OL110010 (as considered 7bit 
representation). In 0110010, there are four 0’s and three I‘s. As the number of 1’s is less, so we take the flag 
as 1. 1 is present in 2", 5" and 6" bit positions. Now we embed flag 1, then the number of 1’s i.e., three, then 
bit positions of 1’s, which is 2m 5" and 6". We embed this value LSB modification of RGB colour cover 
image. Thus the ASCII value 50 is encrypted as 7, 2, 5 and 6. 7 come from 111, where | is the flag value and 
11 is the number of 1’s. 2, 5 and 6 come from the positions of 1’s. 

Next character is q. Its ASCII value is 113. Binary equivalent of 113 is 1110001. In 1110001, 
there are 0 3 0’s and four 1‘s. As the number of 0’s is lesser than number of 1’s, so we take the flag as 0. 0 is 
present in 2", 3", 4"" bit positions. Now we embed flag 0, then the number of 0’s i.e., three, then bit positions 
of 0’s, which are 2"°, 3, 4th. We embed this by LSB modification of RGB colour cover image. Thus the 
ASCII value 113 is encrypted as O11, 010, O11, 100 1.e. 3, 2, 3, 4. 0 comes from 011, where 0 1s the flag 
value and 11 is the number of 0’s. 010, 011, 100 come from the positions of 0’s those are 2, 3, 4 respectively. 

Finally we embed dot (.). Its ASCII value is 46. Binary equivalent is 0101110. In 0101110, there are 
three 0’s and four 1’s. As the number of 0’s is less, so we take flag as 0. 0’s are present in 1“, 5" and 7™ bit 
positions. Now we embed flag 0, then the number of 0’s i.e., three, then bit positions of 0’s, which are 1“, 5 
and 7". We embed this value by LSB modification of RGB colour cover image. Thus the ASCII value 46 is 
encrypted as 3, 1, 5 and 7. Here, 3 come from 011, where 0 is the flag value and 11 is the number of 0’s. 
Then 1, 5 and 7 are the positions of the 0’s. ASCII value 46 indicates dot (.). Therefore, it is the end of 
CAPTCHA code. 
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Thus the CAPTCHA B9@m#-~2q. is embedded in an encrypted form into LSB’s of 24 bit RGB cover image 
as 627323757225712611725632343157 

During extraction first pixel’s RGB [20] would generate 6 whose binary equivalent is 110 indicating 
flag’s value | and total number of 1’s are two(10).Then next two pixel’s LSB would be retrieved to find three 
positions of 1’s 1.e., second and seventh position respectively. Thus instead of ASCII 66, the encrypted value 
6, 2, 7 has been retrieved. 

6,2,7 indicate a value which has total two 1’s at second and seventh position, that means other 
positions are left as 0’s. We know printable ASCII range 1s up to 127 and 127 1s the ASCII value of DEL that 
cannot be used to create CAPTCHA. So, maximum value is 126 whose binary equivalent is 01111110 that 
can be used to construct the CAPTCHA. Thus from 6, 2, 7 we can understand flag value is 1, no of 1’s are 
two and 1’s are present in 2™ and 7" position. So we get 1000010 and its equivalent ASCII 66 i.e. the ASCII 
of digit B. 

Next pixel’s RGB would generate 3 whose binary equivalent is 011 indicating flag’s value 0 and 
total number of 0’s are three (11). Then next we retrieve three pixel’s LSB to find three positions of 0’s 1.e. 
second, third and seventh position respectively. Thus the encrypted value 3, 2, 3, 7 has been retrieved. 
Thus finally we get 011, 010, 011, 111. 

3, 2, 3, 7 indicates a value which has total three 0’s at second, third and seventh position that means 
other positions are left as 1’s except MSB which 1s always 0 here as printable ASCII range is up to 127 and 
127 itself is the ASCII value of DEL that cannot be used to create CAPTCHA. So, maximum value is 126 
whose binary equivalent is OII11110. Thus finally we get O111001 from 011,010,011,111 which is 
equivalent to ASCII 57 1.e., the ASCII of digit 9. 

Next pixels’ decimal value 5, 7 extracted as 101, 111. RGB would generate decimal 5 whose binary 
equivalent is 101 indicating flag’s value 1 and total number of 1’s is one (01). Then we retrieve next pixel’s 
LSBs to find the position of 1’s 1.e., 7. Thus encrypted value 5, 7 is considered as 1000000 (value which 
contains | at 7" bit and rest values are filled up with 0’s) i.e. 64 in decimal, the ASCII of @ 

Next we extract binary 010, 010, 101 1.e. in decimal 2, 2, 5. Here flag is 0 and total number of 0’s 
are two (10) at position 2 (010) and position 5(101). So, we get 1101101 (value which contains 0 at 2™ and 
5" bit positions. Rest of the values are filled up by 1’s) i.e., in decimal 109, the ASCII of m. 

Next we extract binary 111, 001, O10, 110 1.e. in decimal 7, 1, 2, 6. Here flag is 1 and total number 
of 1’s are three (11) at position 1 (001), 2(010) and 6(110). So, we get 0100011 (value which contains | at 
1“, 2™ and 6" bit positions. Rest of the values are filled up by 0’s) i.e. in decimal 35, the ASCII of #. 

Next we extract [21] binary 001, OO1 1.e., in decimal 1, 1. Here flag is 0 and total number of 0 is one 
(01) at position 1 (001). So, we get 1111110 (value which contains 0 at 1™ bit position. Rest of the values are 
filled up by 1’s) 1.e., in decimal 126, the ASCII of ~. 

Next we extract 111, 010, 101 and 110 1.e. in decimal 7, 2, 5 and 6. Here flag is | and total number 
of 1’s are 3(11) at positions 2(010), 5(101) and 110(6). So, we get 0110010 (value which contains | at 2 Se 
and 6"" bit positions. Rest of the values are filled up by 0’s) ie. in decimal 50, the ASCII of 2. 

Next we extract 011, 010, O11 and 100 1.e. in decimal 3, 2, 3 and 4. Here flag is O and total number 
of 0’s are 3(11) at positions 2(010), 3(011) and 4(100). So, we get 1110001 (value which contains 0 at 2", 
3", 4" bit positions. Rest of the values are filled up by 1’s) i.e. in decimal 113, the ASCII of q. 

Finally we extract 011,001,101,111, Here 0 1s the flag value, number of 0’s are 11 in binary 1.e., 3 in 
decimal, Three 0’s are present in 1“, 5" and 7” position. So we get 3, 1, 5 and 7. From here we can 
understand that flag value is 0. Three numbers of 0’s are present at 1“, 5" and 7" position i.e., we retrieve 
0101110 and its equivalent ASCII 46 1.e. the ASCII of dot (.). By getting dot (.) we can understand that it is 
the end of CAPTCHA codes. Thus we extract the LSBs of all participating pixels to retrieve back our 
CAPTCHA codes B9 @m#~2dq. 





4. RESULTS AND DISCUSSION 
For comparing stego image with cover image the commonly used measures are Mean-Squared 
Error, Peak Signal-to-Noise Ratio. 


4.1. PSNR & MSE 

In this new encrypted method PSNR [22], MSE, RMSE are standard measurements [23] used to test 
the quality of the stego images. MSE measures the average of the squares of the errors. The error is the 
amount by which the pixels value is the difference between the stego image and the cover image. RMSE 
stands for Root Mean Square Error. PSNR 1s the ratio between the maximum possible power of a signal and 
the power of corrupting noise that affects the degree of exactness of its representation. The signal here is the 
cover image, and the noise is the error caused by the embedded bits into stego image. If the value of PSNR is 
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high then the quality of the stego image would be good enough. Let the cover image’s pixels be represented 
as C (1, ]) and the stego image pixels as S (i,j) for fixed image [24] size of MXN. 


255 * 255 


PSNR = 10 10810 Tyce 


Where MSE denotes the mean square error, which is given as 


MSE = 
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Comparison of PSNR, MSE difference between LSB embedded stego image and new encrypted 
method embedded stego image as shown in Table 1. A higher PSNR value denotes that difference between 
cover image and the stego image is more invisible to the human eye interpretation. Cover image and stego 
image as shown in Figure | & 2. 


Table 1. Comparison of PSNR, MSE Difference between LSB Embedded Stego Image and New Encrypted 
Method Embedded Stego Image 


Tools 24 bit colour image (LSB) 24 bit colour image by new encrypted method in 
image steganography (Our Technique) 

PSNR 41.22 42.56 

MSE 4.72 3.57 

RMSE 2.17 1.88 





Figure 1. Cover image Figure 2. Stego image 


4.2. Standard Deviation 

It is a measure that is used to quantify the amount of variation or dispersion of a set of data values of 
pixels. A low standard deviation indicates that the pixel values tend to be close to the mean, while a high 
standard deviation indicates that the pixel values are spread out over a wider range of values. Comparison of 
SD, variance difference between LSB embedded stego image and new encrypted method embedded stego 
image as shown in Table 2. 


Table 2. Comparison of SD, Variance Difference between LSB Embedded Stego Image and 
New Encrypted Method Embedded Stego Image 


Tools 24 bit colour image 24 bit colour image by new encrypted method in 
image steganography (Our Technique) 

SD 2.1 1.79 

VARIANCE 4.4] 3.2041 


The other Image quality parameters are Normalized Cross Correlation, Average Difference and 
Maximum Difference. Let the original image’s pixels be represented as C (1, j) and the stego image pixels as 
S(i,j) for fixed image size of M x N. Normalized Cross Correlation (NCC) is defined as: 
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When the absolute value of the normalized correlation coefficient equals one, then there exist a linear relation 
between the two samples (cover image & stego image), while on the other hand, when the value of the 
normalized correlation coefficient equals zero, then the two samples have no linear relation. 
Average Difference (AD) is defined as: 


w= rd Sé)-CaN)) 
j= 





t=1 


AD is simply the average difference of pixels between the cover image and stego image. 
Maximum Difference (MD) is defined as: 


MD = Max(|SG@j) — CG) 


MD is the maximum difference of pixels between the cover image and stego image. Comparison of NCC, 
AD and MD difference between LSB embedded stego image and new encrypted method embedded stego 
image as shown in Table 3. 


Table 3. Comparison of NCC, AD and MD Difference between LSB Embedded Stego Image and 
New Encrypted Method Embedded Stego Image 


Tools 24 bit colour image (LSB) 24 bit colour image by new encrypted method 
in image steganography (Our Technique) 


NCC 0.9965 0.9998 
AD 0.013 0.002 
MD elas, 2.99 


5. CONCLUSION 

Thus we use a new technique to generate an encrypted version of CAPTCHA and then embed it into 
cover image generating stego image. Attackers cannot have any clue how to retrieve the CAPTCHA codes. 
Here no need of the use of any encryption [25] or decryption key to embed or extract the CAPTCHA codes. 
Thus embedding algorithm itself generates the encrypted version of CAPTCHA codes and then embed it into 
cover image and extraction algorithms itself extracts the actual CAPTCHA codes without the help any key. 
In future we can use encryption and decryption key along with this algorithm to provide more robustness in 
the field of image steganography. 
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